PatchSiren

PatchSiren cyber security CVE debrief

CVE-2025-39841 Siemens CVE debrief

CVE-2025-39841 is a high-severity memory-safety flaw described in the Linux kernel lpfc deferred receive path. The advisory says the buffer was freed before its context pointer was cleared, creating a use-after-free window and possible double-free condition when concurrent paths inspect the same pointer. CISA’s advisory ties the issue to Siemens SIMATIC CN 4100 and recommends updating to V5.0 or later.

Vendor
Siemens
Product
SIMATIC CN 4100
CVSS
HIGH 7.8
CISA KEV
Not listed in stored evidence
Original CVE published
2026-01-28
Original CVE updated
2026-02-25
Advisory published
2026-01-28
Advisory updated
2026-02-25

Who should care

Organizations running Siemens SIMATIC CN 4100 systems covered by the advisory, especially environments that rely on the affected Linux-kernel-based receive-path handling. OT/ICS teams, platform maintainers, and patch-management owners should prioritize review and upgrade planning.

Technical summary

The issue is a sequencing bug: the deferred receive path freed the RQ buffer first and only then cleared the context pointer under lock. That ordering can race with other locked paths, including ABTS and repost handling, which also inspect and release the same pointer. The advisory notes the repost path already follows the safer pattern of detaching the pointer under lock and freeing it after the lock is dropped; the deferred path should match that pattern. The published CVSS vector is CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H.

Defensive priority

High. The advisory assigns CVSS 7.8 (HIGH), the flaw can affect availability and memory integrity, and remediation is available in the vendor advisory.

Recommended defensive actions

  • Review whether Siemens SIMATIC CN 4100 deployments are in scope for the advisory and map affected versions.
  • Apply the vendor remediation and upgrade to V5.0 or later as directed by Siemens/CISA.
  • Prioritize patch planning for exposed or operationally critical systems because the impact is high if the flaw is reachable.
  • Track CISA and Siemens advisories for any follow-up guidance or revised affected-version information.
  • Validate asset inventories so affected product versions can be identified quickly during maintenance windows.

Evidence notes

Primary evidence comes from the CISA CSAF advisory ICSA-26-134-10 (published 2026-05-12, republished 2026-05-14) and the linked Siemens ProductCERT advisory references. The source description explicitly states the buffer free/clear ordering bug, the concurrent-path race, and the remediation to update to V5.0 or later. Timing in this brief uses the supplied CVE publication and modification dates only.

Sources and references

Verified primary and authoritative sources

  • CVE-2025-39841 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2025-39841

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2025-39841 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2025-39841

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • Source item URL

    Unverified legacy reference

    URL: https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/OT/white/2026/icsa-26-134-10.json

    cisa_csaf

  • Source reference

    Unverified legacy reference

    URL: https://cert-portal.siemens.com/productcert/csaf/ssa-032379.json

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://cert-portal.siemens.com/productcert/html/ssa-032379.html

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/news-events/ics-advisories/icsa-26-134-10

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/news-events/ics-alerts/ics-alert-10-301-01

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/resources-tools/resources/ics-recommended-practices

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/topics/industrial-control-systems

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf

    Reference

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.